If Scott's wondering whom specifically to blame: Accretion of safeguards. It's inevitable, it seems. Something goes wrong, the process is amended to avoid that

If Scott's wondering whom specifically to blame: Accretion of safeguards. It's inevitable, it seems. Something goes wrong, the process is amended to avoid that failure case. Something else goes wrong, add another amendment. All individual additions are likely net positive - positive in 99% of the cases, negative in the rest. Assuming events are mostly independent, you'll sooner or later are in a world were net positive outcomes are becoming less likely than net negative ones. You can sometimes sidestep that by combining/rewriting rules to some extent, but in the limit, you can only avoid all additional risk if you prevent any changes. That's not a fault of IRBs. That's a fault of trying to minimize risks. I'm not sure there is a good answer here outside of "here's the maximum amount of risk we're willing to take, and here are the few clear ethical boundaries we'll never overstep". There's a reason any place that's dealing with a lot of constraints is concerned with risk budgets, not risk elimination. And I'm not sure there's a lot of thinking on probabilistic ethics. (Or maybe I just can't find it)